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Amendments to the Claims 



This listing of claims will replace all prior versions of claims in the application: 
Listing of Claims: 

1 . (Currently Amended) A protocol diagnostic system, comprising: 

a data stream monitor component that accesses raw network data and copies at least one 
protocol specific subset of the raw network data; and 

a diagnostics engine comprising at least one protocol state compressor that analyzes the 
at least one protocol specific subset of the raw network data, the protocol specific subset of raw 
network data being correlated with the protocol state compressor, the diagnostics engine 
determines condition of network connectivity, and the data stream monitor component utilizes at 
least one lexical rule set associated with the at least one protocol state compressor to determine 
subsets of the raw network data to copy, the at least one lexical rule set stores at least one of 
information regarding structure of subsets of the raw network data and protocol specific 
information , and 



where the diagnostic engine, upon initialization, stores information associated with 
protocols to be monitored in the at least one lexical rule set, upon occurrence of a network 
connectivity problem, stores information associated with additional protocols, and upon 
correction of the network problem, deletes information associated with selected protocols from 
the at least one lexical rule set . 

2. (Canceled) 

3. (Original) The protocol diagnostic system of claim 1 , the diagnostics engine further 
comprising at least one lexical rule set. 
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4. (Currently Amended) A method that facilitates network diagnostics, comprising: 
accessing raw real-time network data; 

selectively providing subsets of the raw real-time network data to protocol state 
compressors based at least in part upon lexical rule sets corresponding to the protocol state 
compressors, the lexical rule sets store at least one of information regarding structure of subsets 
of the raw real-time network data and protocol specific information; 

storing and deleting information associated with protocols to be monitored in the lexical 
rule sets, where upon occurrence of a network connectivity problem, information associated with 
additional protocols is stored, and upon correction of the network problem, the information 
associated with the additional protocols is deleted from the lexical rule sets ; 

using the protocol state compressors to analyze the respective data subsets; and 

diagnosing health status of a system based at least in part upon the analysis of at least one 
of the protocol state compressors. 

5. (Canceled) 

6. (Original) The method of claim 4, further comprising at least one of the following acts: 
diagnosing a network connectivity problem based at least in part upon the analysis of at 

least one of the protocol state compressors; and 

initiating corrective action associated with the network connectivity problem. 

7. (Original) The method of claim 4, further comprising at least one of the following acts: 
storing information associated with the health status of the system; and 

providing information to a user regarding the health status of the system. 
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8. (Currently Amended) A computer network diagnostic system, comprising: 

a data stream monitor/multiplex component that accesses real-time network data, 
selectively determines at least one subset of the real-time network data to multiplex based at least 
in part upon at least one lexical rule set; 

a data stream distribution engine that demultiplexes the multiplexed data based at least in 
part upon the at least one lexical rule set; and, 

a diagnostics engine having a plurality of protocol state compressors, the protocol state 
compressor being associated with the at least one lexical rule set, the protocol state compressors 
analyzing their respective subsets of demultiplexed data received from the data stream 
distribution engine, the diagnostics engine further including an event correlator/inference engine 
receives results of the analysis of the plurality of protocol state compressors, the event 
correlator/inference engine correlates the results to detect a system problem ; and 

where the diagnostic engine, upon occurrence of a network connectivity problem, stores 
information associated with additional protocols., and upon correction of the network problem, 
deletes information associated with the additional protocols from the at least one lexical rule set . 

9. (Previously Presented) The protocol diagnostic system of claim 8, the event 
correlator/inference engine diagnoses a potential source of the system problem. 

10. (Previously Presented) The protocol diagnostic system of claim 9, the event 
correlator/inference engine initiates corrective action related to the system problem. 

1 1 . (Original) The protocol diagnostic system of claim 9, the event correlator/inference 
engine utilizing at least one of a neural network and an expert system to facilitate diagnosis of 
the potential source of the system problem. 

12. (Original) The protocol diagnostic system of claim 8, the diagnostics engine further 
comprising the at least one lexical rule set. 
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13. (Currently Amended) A method that facilitates network diagnostics, comprising: 
accessing at least one lexical rule set coinciding with a protocol to be monitored by a 

corresponding protocol state compressor; 

storing and deleting information associated with protocols to be monitored in the at least 
one lexical rule set, where upon occurrence of a network connectivity problem, information 
associated with additional protocols is stored, and upon correction of the network problem, the 
information associated with the additional protocols is deleted from the at least one lexical rule 
set; 

copying raw data frames coinciding with the at lexical rule set; 
multiplexing the copied raw data frames; 
demultiplexing the copied raw data frames; 

providing the copied raw data frames to the protocol state compressor; 

using the protocol state compressor to analyze corresponding raw data frames utilizing at 
least in part upon the corresponding lexical rule set; and 

correlating information received from the protocol state compressor to facilitate diagnosis 
of health status of a system. 

14. (Original) The method of claim 13, further comprising at least one of the following acts: 
determining whether an additional protocol to be monitored has been added; and 
adding a protocol state compressor and corresponding lexical rule set associated with the 

additional protocol. 

15. (Original) The method of claim 13, further comprising at least one of the following acts: 
initiating corrective action based at least in part upon the correlated information; and 
providing information to a user regarding the health status of network connectivity. 



5 



10/038,246 



MS155556.01/MSFTP300US 



16. (Original) The method of claim 13, further comprising at least one of the following acts: 
storing historical information regarding the health status of network connectivity; 
determining potential sources of a problem associated with network connectivity; 
accessing historical information regarding the health status of network connectivity; 
calculating a probability of utility based at least in part upon the potential sources of the 

problem and accessed historical information; and, 

consecutively initiating corrective action based at least in part upon the probability of 

utility. 

17. (Currently Amended) A diagnostic engine for a server of a computer system, comprising: 
a plain language notification data information store storing plain language notification 

information associated with a plurality of potential server problems; 

a protocol specific event information data store storing information associated with server 
health status; aadr 

at least one lexical rule set that stores information regarding structure of subsets of data 
and protocol specific information, where upon occurrence of a network connectivity problem, 
information associated with additional protocols is stored, and upon correction of the network 
problem, information associated with the additional protocols is deleted from the at least one 
lexical rule set; and 

a self healing component that analyzes information stored in the protocol specific event 
information to determine at least one of appropriate corrective action and appropriate plain 
language notification, the plain language notification based at least in part upon information 
stored in the plain language notification data store. 
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18. (Currently Amended) A data packet adapted to be received by a self-healing component, 
the data packet comprising: 

a protocol specific identifier; andr 

at least one lexical rule set that stores information regarding structure of subsets of data 
and protocol specific information, where upon occurrence of a network connectivity problem, 
information associated with additional protocols is stored, and upon correction of the network 
problem, information associated with the additional protocols is deleted from the at least one 
lexical rule set; and 

protocol specific event data associated with at least one of a network problem and 
network status, the protocol specific event data being employed by the self-healing component to 
facilitate at least one of appropriate corrective action and appropriate plain language notification. 

19. (Currently Amended) A computer readable medium having computer usable components 
for a protocol diagnostics engine, comprising: 

at least one protocol state compressors, the protocol state compressor being associated 
with at least one ef lexical rule set, the protocol state compressor analyzing respective subsets of 
demultiplexed data received from the data stream distribution engine , where the diagnostic 
engine, upon initialization, stores information associated with protocols to be monitored in the at 
least one lexical rule set, the diagnostic engine, upon occurrence of a network connectivity 
problem, stores information associated with additional protocols, and the diagnostic engine, upon 
correction of the network problem, deletes information associated with selected protocols from 
the at least one lexical rule set ; and, 

an event correlator/inference engine that receives results of the analysis of the protocol 
state compressor, the event correlator/inference engine correlates the results to detect a system 
problem. 
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20. (Currently Amended) A protocol diagnostic system, comprising: 
means for real-time accessing of network data; 

means for copying a subset of the network data based at least in part upon lexical rule 
sets, the lexical rule sets storing at least one of information regarding structure of the subset of 
network data and protocol specific information; and 

means for storing and deleting information associated with protocols to be monitored in 
the lexical rule sets, where upon occurrence of a network connectivity problem, information 
associated with additional protocols is stored, and upon correction of the network problem, the 
information associated with the additional protocols is deleted from the lexical rule sets; and 

means for analyzing the subset of network data, the analysis facilitating determining 
network status. 



